Data protection

The processing of personal data by the BGA

In carrying out the tasks entrusted to it by the amended Law of 22 June 2022 on the management and recovery of seized or confiscated assets (hereinafter the "Law of 22 June 2022"), the Asset Management Office (hereinafter “BGA”) is required to process personal data.

Pursuant to Article 3(5) of the Law of 22 June 2022, the BGA is responsible for the centralised and computerised management of data relating to seized and confiscated assets, regardless of their nature, which do not constitute evidence.

In this capacity, the BGA carries out the processing of personal data which centralises decisions on seizure and confiscation, as well as decisions on disposal, destruction, release and restitution, regardless of the nature of the assetm, except for pieces of evidence, as well as all relevant information relating to the asset in question, its location and its owners or holders (Article 8 of the Law of 22 June 2022).

Personal data

Pursuant to Article 8(2) of the Law of 22 June 2022, the BGA maintains a register containing personal data, the computerised section of which includes the following information:

1. information relating to natural and legal persons involved in the legal proceedings:
   • for natural persons: title, surname, first name, aliases, date and place of birth, address, and the surnames, first names and addresses of legal representatives, where applicable;
   • for legal persons: company name, legal form, registered office, RCS number, and the surnames, first names and addresses of legal representatives;
   • indicator of ownership status, holder of the seized property and nature of the real right (joint ownership, bare ownership, usufruct) and names of the joint owners,
2. information relating to persons involved in the seizure and confiscation proceedings:
   • judicial police officer: surname, first name, unit of assignment;
   • customs officer: surname, first name, unit of assignment;
   • magistrate: surname, first name, position, court;
   • foreign authority: surname, first name, department;
3. information relating to the proceedings and the seized and/or confiscated asset:
   • case: case reference, date of referral to the BGA, type of proceedings, case number, report number, date and nature of judicial decisions concerning the seized and confiscated property;
   • offence: offences justifying the seizure and confiscation;
   • seized and/or confiscated asset: seal number, nature of the asset, characteristics of the asset (description, value, location, land registry, date of acquisition of the asset, entries in the land registry, town, office, volume number, mortgage, lender’s privilege), date and place of seizure, actions taken by the BGA following the management remit (location of the asset, sale of the asset, disposal, destruction), allocation of funds following the management of the asset to the State Treasury or the Fund for Combating Certain Forms of Crime, data relating to tenants or occupants of the assets (surnames, first names, bank details, file references at the family allowance fund);
   • agreements: information relating to natural and legal persons who have entered into an agreement with the BGA, identification and location of the asset held by a person other than the BGA,
4. information relating to civil parties eligible for compensation: surname, first name, address, amount of the claim, date of referral to the BGA.

Retention period

The maximum retention period for personal data is thirty years from the date on which the management of assets entrusted to the BGA is concluded through the allocation of the proceeds generated by their management (Article 8(2) of the Law of 22 June 2022).

Access to personal data

Records relating to seized and confiscated assets and to the key parts referred to in Article 8(2) of the Law of 22 June 2022, as well as the personal data associated therewith, are accessible:

1. to other competent administrative authorities which need to know such information in the performance of their statutory duties for a maximum period of ten years from the date of closure of the administration by the BGA;
2. to the competent authorities for the purpose of detecting criminal offences, conducting investigations or prosecutions in this regard, or enforcing criminal sanctions, for a period of ten years following the closure of the case by the BGA.

This provision applies without prejudice to cases in which specific personal data have been transmitted to a competent authority for the purposes of detecting criminal offences, conducting investigations and prosecutions in this regard, or enforcing criminal sanctions, and are used in this specific context, or to other competent authorities for a compatible purpose provided for by law. In such cases, the processing of such data by the competent authorities is governed by the Law of 1 August 2018 on the protection of natural persons with regard to the processing of personal data in criminal matters and in matters of national security.

The data controller

The Director of the BGA is the data controller (Article 8(2) of the Law of 22 June 2022).

The Data Protection Officer (DPO)

The appointment of a Data Protection Officer is mandatory where the processing of personal data is carried out by a public authority or a public body.

The duties of the Data Protection Officer are:

1. to inform and advise the data controller and the staff carrying out the processing on their obligations under data protection legislation;
2. to monitor compliance with data protection legislation and the data controller’s internal rules on the protection of personal data;
3. to provide advice, upon request, regarding the data protection impact assessment and to verify its implementation;
4. to cooperate with the supervisory authority;
5. to act as a point of contact for the National Data Protection Commission.

In carrying out his or her duties, the Data Protection Officer shall take due account of the risk associated with processing operations, having regard to the nature, scope, context and purposes of the processing.

The principles governing the processing of personal data

Personal data must be:

• processed lawfully, fairly and in a transparent manner in relation to the data subject;
• collected for specified, explicit and legitimate purposes, and not further processed in a manner incompatible with those purposes;
• adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed;
• accurate and, where necessary, kept up to date;
• kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed.

The security of personal data

Personal data shall be processed in such a way as to ensure appropriate security, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures

In accordance with Article 11 of the amended Law of 16 April 1979 establishing the general status of civil servants, a BGA official is prohibited from disclosing facts of which he or she has become aware by virtue of his or her duties and which are of a confidential nature either by their very nature or by the instructions of his or her superiors, unless exempted from this by the competent minister.